Loading vulnerability…
CVE-2026-44827 is a remote code execution vulnerability in Hugging Face Diffusers prior to version 0.38.0. The flaw is in the custom pipeline resolution logic used during DiffusionPipeline.from_pretrained(). In the vulnerable flow, the _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py interpolates the custom_pipeline parameter into a Python filename using a pattern equivalent to appending .py. When the caller does not supply custom_pipeline, the default None value is converted into the literal filename None.py. This creates an inconsistency with the trust_remote_code safeguard: the security check in the download path treats an omitted custom_pipeline as absent and therefore does not require explicit trust, while the downstream module-loading path resolves the same value into a concrete Python module name and loads it if present in the repository. A malicious Hugging Face Hub repository can therefore include a Python module with that derived name and a pipeline class that appears legitimate, causing attacker-controlled code to be downloaded and executed during a normal pipeline load even when trust_remote_code is false or omitted.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity code-injection vulnerability in Hugging Face's diffusers library that abuses resolution of a default "None.py" file as custom pipeline code, enabling arbitrary code execution when loading a malicious model repository.
A high-severity code injection vulnerability in Hugging Face Diffusers that bypasses the trust_remote_code safeguard and enables arbitrary code execution via a crafted custom pipeline named "None.py".
A high-severity arbitrary code execution vulnerability in Hugging Face's diffusers library caused by a trust check bypass during model loading, allowing a crafted repository containing None.py to execute attacker code.
A related remote code execution vulnerability in HuggingFace Diffusers caused by string interpolation on the custom_pipeline parameter, enabling RCE without trust_remote_code=True.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.